Trend Micro’s Rik Ferguson blogs about current security issues.

The mobile threat: FUD or MUD

Preface: This blog is not about open source vs closed, it’s also not about Android vs iOS or any other mobile operating system. It’s about criminals vs people, it’s about hype and reality and it’s about knee-jerk self-preservation vs openness and consideration.

Last Wednesday, Chris DiBona (Open Source Programs Manager at Google Inc.) made a post on his Google+ profile hitting out at claims about “open source being inherently insecure’ and that android is festooned with viruses because of that and because we do not exert apple like controls over the app market“.

While Chris does make some reasonable points regarding the comparative resilience and security of open source code, I can’t help but feel that he is wilfully missing the point when it comes to the current threat landscape that confronts smartphone users today. I’ll deal with the points I disagree with in the same sequence that Chris raises them:

1 – “All the major vendors have app markets, and all the major vendors have apps that do bad things, are discovered, and are dropped from the markets.”

Yes Chris, the major vendors all distribute apps based on the Marketplace or App Store model. One or more rogue or plain malicious apps have been discovered in most of those distribution channels and some of them get removed. Some of them even get removed in a timely fashion. Perhaps this is where some of the criticism based on “openness” has been misunderstood. As far as I am concerned, the problem pertinent to Android is not that the OS itself is open source, like I said you made some valid points about that, but that the app distribution mechanism is entirely open. Android embraces the concept of multiple third party marketplaces in addition to the “official” marketplace, even in the “official” marketplace there is no upfront vetting of code or functionality. Couple that with the undeniable and deserved popularity of the platform, it is no surprise that criminals are already actively exploiting an opportunity here. It’s not the open source, it’s the openness of the source.

2 – “Yes, virus companies are playing on your fears to try to sell you bs protection software for Android, RIM and IOS. They are charlatans and scammers. IF you work for a company selling virus protection for android, rim or IOS you should be ashamed of yourself.”

Well now, this seems to be plainly stating that there is no malware problem for the popular mobile platforms. The weight of evidence (not to mention criminal intent) would seem to be heavily against you here Chris and Android itself seems to be the target of choice. TrendLabs for example have documented a 1410% increase in Android malware in the period January to July 2011. Let me be very clear. I am well aware that this rate of increase is starting from a low base, those four figure increases are not as shocking as they may at first appear. In raw numbers the total amount of malware is of course orders of magnitude lower than for example the Wintel platform. However the more important figure is not the total number of malware, but the rate of increase of that malware quarter on quarter and year on year. That demonstrates current, active and sustained criminal interest in the mobile platform. It’s not complicated, criminals follow consumers; always have, always will.

3 – “If you read an analyst report about ‘viruses’ infecting ios, android or rim, you now know that analyst firm is not honest and is staffed with charlatans. There is probably an exception, but extraordinary claims need extraordinary evidence. If you read a report from a vendor that trys to sell you something based on protecting android, rim or ios from viruses they are also likely as not to be scammers and charlatans. ”

I think the figures referenced above and the litany of mobile woe researched and documented by TrendLabs here speak for themselves. This clinging desperately to the term “virus” in a last ditch attempt to demonstrate that a platform is free of malware is exactly the same language I have heard from MacOS enthusiasts (I am one before you flame me) who have been historically unwilling to admit that now the criminals are after them as well. It may well be that there are no viruses in the strictest definition of the term Chris, where do you stand on criminal malware for mobile devices?

4 – “Please note: Policy engines, and those tools that manage devices from an corporate IT department are not the same thing at all, but sometimes marketers in companies that sell such things sometimes tack on ‘virus’ protection. That part is a lie, tell your vendor to cut it out.”

So we agree that security of mobile devices extends far beyond the threat from malware. Of course there is loss, theft, inappropriate access, device tracking, web-based threats through social networking or phishing for example and many other areas to consider (by the way this is important for the consumer too) but advising your users to request that vendors remove functionality designed to detect malicious software? Well I guess that’s one way to make a platform appear malware free…

Am I ashamed of myself? Not at all. I’d prefer to offer protection against a growing threat to personal and business security than to bury my head in the sand and defend my stance with wild accusation.

Your post very much accuses security vendors of FUD, sowing Fear, Uncertainty and Doubt. I hope I have demonstrated that is very much not the case. Maybe your outburst was more a case of MUD? Myopic Unalloyed Denial.

Post navigation

17 thoughts on “The mobile threat: FUD or MUD”

Well-done sir. Google deserves MUCH criticism for its idiotically vulnerable implementation of the app market(s). Chris embarrassed himself and Google with his security-ignorant post. Chris – go back to security school, then fix your mess.